Windows DISM Install PowerShell Web Access
Bypass User Account Control
Web
Windows Enable PowerShell Web Access
PowerShell
WS FTP Remote Code Execution
Exploit Public-Facing Application
JetBrains TeamCity RCE Attempt
Exploit Public-Facing Application
Detect DNS requests to Phishing Sites leveraging EvilGinx2
Spearphishing via Service
Java Class File download by Java User Agent
Exploit Public-Facing Application
Detect web traffic to dynamic domain providers
Web Protocols
Hunting for Log4Shell
Exploit Public-Facing Application, External Remote Services
Windows Outlook WebView Registry Modification
Modify Registry
Detect Remote Access Software Usage URL
Remote Access Software
Ivanti EPM SQL Injection Remote Code Execution
Exploit Public-Facing Application
Confluence Unauthenticated Remote Code Execution CVE-2022-26134
Server Software Component, Exploit Public-Facing Application, External Remote Services
Adobe ColdFusion Access Control Bypass
Exploit Public-Facing Application
Ivanti Connect Secure SSRF in SAML Component
Exploit Public-Facing Application
Citrix ShareFile Exploitation CVE-2023-24489
Exploit Public-Facing Application
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527
Exploit Public-Facing Application
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
Exploit Public-Facing Application, External Remote Services
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
Exploit Public-Facing Application, External Remote Services
Splunk Protocol Impersonation Weak Encryption Configuration
Protocol Impersonation
Confluence Data Center and Server Privilege Escalation
Exploit Public-Facing Application
Windows Impair Defense Disable Web Evaluation
Disable or Modify Tools, Impair Defenses
AWS Defense Evasion Impair Security Services
Disable or Modify Cloud Logs, Impair Defenses
Spring4Shell Payload URL Request
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Supernova Webshell
Web Shell, External Remote Services
Log4Shell JNDI Payload Injection Attempt
Exploit Public-Facing Application, External Remote Services
Splunk Authentication Token Exposure in Debug Log
Log Enumeration
Citrix ADC Exploitation CVE-2023-3519
Exploit Public-Facing Application
ConnectWise ScreenConnect Authentication Bypass
Exploit Public-Facing Application
High Volume of Bytes Out to Url
Exfiltration Over Web Service
Jenkins Arbitrary File Read CVE-2024-23897
Exploit Public-Facing Application
PaperCut NG Remote Web Access Attempt
Exploit Public-Facing Application, External Remote Services
Web Spring Cloud Function FunctionRouter
Exploit Public-Facing Application, External Remote Services
Confluence CVE-2023-22515 Trigger Vulnerability
Exploit Public-Facing Application
Exploit Public Facing Application via Apache Commons Text
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
JetBrains TeamCity Authentication Bypass CVE-2024-27198
Exploit Public-Facing Application
Ivanti Connect Secure Command Injection Attempts
Exploit Public-Facing Application
Microsoft SharePoint Server Elevation of Privilege
Exploitation for Privilege Escalation
VMWare Aria Operations Exploit Attempt
External Remote Services, Exploit Public-Facing Application, Exploitation of Remote Services, Exploitation for Privilege Escalation
Web Remote ShellServlet Access
Exploit Public-Facing Application
VMware Workspace ONE Freemarker Server-side Template Injection
Exploit Public-Facing Application, External Remote Services
Detect attackers scanning for vulnerable JBoss servers
System Information Discovery, External Remote Services
Ivanti Connect Secure System Information Access via Auth Bypass
Exploit Public-Facing Application
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078
Exploit Public-Facing Application, External Remote Services
Ivanti Sentry Authentication Bypass
Exploit Public-Facing Application
Adobe ColdFusion Unauthenticated Arbitrary File Read
Exploit Public-Facing Application
WordPress Bricks Builder plugin RCE
Exploit Public-Facing Application
Windows Exchange Autodiscover SSRF Abuse
Exploit Public-Facing Application, External Remote Services
O365 Multiple Mailboxes Accessed via API
Remote Email Collection
Log4Shell JNDI Payload Injection with Outbound Connection
Exploit Public-Facing Application, External Remote Services
Cisco IOS XE Implant Access
Exploit Public-Facing Application
Web JSP Request via URL
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
O365 OAuth App Mailbox Access via EWS
Remote Email Collection
Juniper Networks Remote Code Execution Exploit Detection
Exploit Public-Facing Application, Ingress Tool Transfer, Command and Scripting Interpreter
Windows PowerShell IIS Components WebGlobalModule Usage
Server Software Component, IIS Components
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
Exploit Public-Facing Application
ASL AWS Defense Evasion Impair Security Services
Disable or Modify Cloud Logs, Impair Defenses
SQL Injection with Long URLs
Exploit Public-Facing Application
Fortinet Appliance Auth bypass
Exploit Public-Facing Application, External Remote Services
VMware Server Side Template Injection Hunt
Exploit Public-Facing Application, External Remote Services
Citrix ADC and Gateway Unauthorized Data Disclosure
Exploit Public-Facing Application
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952
Exploit Public-Facing Application, External Remote Services
Windows PowerShell Disable HTTP Logging
Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components